Refer to the exhibit.
An attacker is connected to interface Fa0/11 on switch A-SW2 and attempts to establish a DHCP
server for a man-in-middle attack. Which recommendation, if followed, would mitigate this type of
attack?
A.
All switch ports in the Building Access block should be configured as DHCP trusted ports.
B.
All switch ports in the Building Access block should be configured as DHCP untrusted ports.
C.
All switch ports connecting to hosts in the Building Access block should be configured as DHCP
trusted ports.
D.
All switch ports connecting to hosts in the Building Access block should be configured as DHCP
untrusted ports.
E.
All switch ports in the Server Farm block should be configured as DHCP untrusted ports.
F.
All switch ports connecting to servers in the Server Farm block should be configured as DHCP
untrusted ports.
Explanation:
One of the ways that an attacker can gain access to network traffic is to spoof responses that
would be sent by a valid DHCP server. The DHCP spoofing device replies to client DHCP
requests. The legitimate server may reply also, but if the spoofing device is on the same segment
as the client, its reply to the client may arrive first.
The intruder’s DHCP reply offers an IP address and supporting information that designates the
intruder as the default gateway or Domain Name System (DNS) server. In the case of a gateway,
the clients will then forward packets to the attacking device, which will in turn send them to the
desired destination. This is referred to as a “man-in-the-middle” attack, and it may go entirely
undetected as the intruder intercepts the data flow through the network.
Untrusted ports are those that are not explicitly configured as trusted. A DHCP binding table is
built for untrusted ports. Each entry contains the client MAC address, IP address, lease time,binding type, VLAN number, and port ID recorded as clients make DHCP requests. The table is
then used to filter subsequent DHCP traffic. From a DHCP snooping perspective, untrusted
access ports should not send any DHCP server responses, such as DHCPOFFER, DHCPACK,
DHCPNAK.
Reference: Understanding and Configuring DHCP Snooping
(http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/13ew/configuration/guide/dhcp.
html)